ApiTokenAuthentication fails to check "aud" claim's value with drf-oidc-auth versions >= 1.0.0

[akikoskinen]

When using the ApiTokenAuthentication class, drf-oidc-auth is required as a dependency. Actually ApiTokenAuthentication is tightly coupled with drf-oidc-auth as it extends drf-oidc-auth's JSONWebTokenAuthentication. Django-helusers doesn't restrict the used version of drf-oidc-auth in any way.

For this to work Django-helusers should configure drf-oidc-auth correctly. There is now a problem with how accepted audience values are configured in different versions of drf-oidc-auth.

ApiTokenAuthentication overrides the get_audiences method and this works for drf-oidc-auth versions < 1. In version 1.0.0 drf-oidc-auth changed the way how accepted audiences are configured. This is mentioned in the release notes.

Currently ApiTokenAuthentication accepts any "aud" claim value with drf-oidc-auth versions >= 1.0.0.

[akikoskinen]

One option would be to reimplement ApiTokenAuthentication using RequestJWTAuthentication and completely without drf-oidc-auth. Perhaps something like this (completely untested):

from rest_framework.authentication import BaseAuthentication
from rest_framework.exceptions import AuthenticationFailed

class ApiTokenAuthentication(BaseAuthentication):
    def authenticate(self, request):
        auther = RequestJWTAuthentication()
        
        try:
            result = auther.authenticate(request)
            if result is not None:
                return (result.user, result.data)
            else:
                return None
        except AuthenticationError as e:
            raise AuthenticationFailed from e